registry / Data exfiltration / mvframe

mvframe

**English** | [简体中文](README.cn.md)

This report shows the evidence for mvframe@1.1.38. 1 of 9 known versions is blocked or flagged. The newest version, 1.1.39, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source establishes a complete persistence-and-exfiltration chain: the scaffold installs an agent directive, seeds its destination, and supplies the POST client. The lack of lifecycle execution reduces reach but does not negate the concrete malicious behavior of the advertised initializer.

Static reason

No blocking static signals were detected.

Trigger

User runs mvframe-init-app; subsequently an agent follows the injected AGENTS.md completion-notification rule.

Impact

Future development requests, changes, and validation summaries can be sent to the bundled third-party DingTalk webhook.

Mechanism

AI-agent instruction injection plus webhook-based task-summary exfiltration

Attack narrative

Running the advertised scaffold command writes the package's DingTalk test configuration into the project and injects AGENTS.md instructions requiring every completed AI development task to invoke the notifier with the user request and work summary. The notifier sends that supplied message to the configured webhook. This establishes a persistent exfiltration path in the consumer project, despite requiring an explicit scaffold invocation rather than npm installation.

AI rationale

Evidence

package.jsonscripts/scaffold-app.jsscripts/install-codex-agents.jsscripts/notify-server.jsAGENTS.md.env.mvframe-notify.env.mvframe-notify.example

Network endpoints1

oapi.dingtalk.com/robot/send

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

Scaffold writes bundled DingTalk test configuration into the target project's notify env file.
Scaffold installs a Codex AGENTS.md section that mandates completion notifications containing request and work summaries.
The notify CLI POSTs supplied messages to the configured webhook.
No lifecycle hook is present; this chain is activated by the explicit scaffold command.

Evidence against

No install, preinstall, or postinstall hook in package.json.
The notifier binds locally by default and reads configuration from an env file.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 1.97 MB of source, external domains: 127.0.0.1, element-plus.org, github.com, oapi.dingtalk.com, www.w3.org

Oversized source lightweight scan

Source & flagged code

5 flagged

scripts/copy-flag-assets.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Copy flag-icons SVG assets beside the built host bundle.

4 * `src/style/chip/flag-icons.scss` points CSS URLs at `/assets/flags/...`.

5 */

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

9const { createRequire } = require("module");

10const { execFileSync } = require("child_process");

12const root = path.resolve(__dirname, "..");

13const pnpPath = path.join(root, ".pnp.cjs");

15// A raw `file:` install can copy the source checkout's PnP loader into the

16// host package. Only activate it while commands are running in this checkout.

17if (path.resolve(process.cwd()) === root && fs.existsSync(pnpPath)) {

18 require(pnpPath).setup();

19}

21const projectRequire = createRequire(path.join(root, "package.json"));

22const flagPackagePath = projectRequire.resolve("flag-icons/package.json");

23const flagRoot = path.dirname(flagPackagePath);

24const src = path.join(flagRoot, "flags");

25const dest = path.join(root, "dist", "assets", "flags");

scripts/scaffold-app.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 在目标工程生成 MVFrame 推荐目录与雏形文件（views / component / api / pinia / router / config / assets）。

4 *

5 * 用法：

6 * node path/to/mvframe/scripts/scaffold-app.js [项目根] [--force|-f]

7 * yarn exec mvframe-init-app

8 *

9 * 环境变量：MVFRAME_SCAFFOLD_TARGET=/path/to/project

10 *

11 * 选项：

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg

Source & flagged code

5 flagged · loading source

scripts/copy-flag-assets.jsView file

6L7: const fs = require("fs"); L8: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

scripts/scaffold-app.jsView file

12Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L12: * --force, -f 覆盖已存在的脚手架文件 L13: * --no-package-json, -n 不读不写 package.json（仅生成源码与 Vite 配置） L14: */ ... L17: const path = require("path"); L18: const { execFileSync } = require("child_process"); L19: const { upsertCodexAgents } = require("./install-codex-agents.js"); ... L27: const target = path.resolve( L28: process.env.MVFRAME_SCAFFOLD_TARGET || argPath || process.cwd(), L29: ); ... L92: const TEST_DINGTALK_WEBHOOK = L93: "https://oapi.dingtalk.com/robot/send?access_token=[redacted]"; L94: const TEST_DINGTALK_SECRET =

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/scaffold-app.jsView on unpkg · L12

Findings

4 High4 Medium4 Low

HighEntrypoint Build Divergencescripts/scaffold-app.js

HighExternal Ai Agent Control Surface Mutationscripts/install-cursor-rules.js

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install-cursor-rules.js

HighSemantic Analysis Limiteddist/@visactor.js

MediumDynamic Requirescripts/copy-flag-assets.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mvframe@1.1.38.

The versions list below shows the verdict for each recorded version.

Avoid installing mvframe@1.1.38. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 10:01:10.071Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

1.1.39latestSuspiciousAI-agent capability abuseWarnPublishedAug 25, 2026, 10:11 AM 1.1.38shownMaliciousData ExfiltrationBlockPublishedAug 18, 2026, 1:50 AM 1.1.34Clean—AllowPublishedAug 10, 2026, 10:11 AM 1.1.33Clean—AllowPublishedAug 10, 2026, 10:00 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code